Educator

Destroying Sessions

• When either the client or server determines that a session is to be ended, a session is destroyed. This serves to:
  • cut the link between any previous & any future HTTP transactions
  • get rid of transient session data that is no longer needed
• session_destroy() is used to destroy a session. It ensures that any session data stored on the server will be deleted.
• To properly destroy a PHP session, the following steps must be taken:
  1. Call session_start() to continue the session
  2. Explicitly delete any session data stored in $_SESSION
  3. Explicitly delete the session cookie
  4. Destroy the session data on the server using session_destroy()
• To explicitly destroy a session cookie, the functions session_name() and session_get_cookie_params() are useful.
• After a specified amount of time, and regardless of the expiration of a session’s cookie, a session’s data file will be considered as expired, or a garbage, by PHP.
• PHP has a garbage collector process that will periodically run to remove any session data files that have been marked as garbage. There are several configuration directives in 'php.ini' related to session garbage collection.
• Additional Resources:
  • Function Reference - session_destroy()
  • Function Reference - session_name()
  • Function Reference - session_get_cookie_params()
  • PHP Manual - Session Configuration Directives